heatmeUp

Privacy Policy

Last updated:

This policy explains how the heatmeUp mobile app and the heatmeup.app website (together, the “Service”) process your personal data, in accordance with Regulation (EU) 2016/679 (GDPR) and French data protection law.

The information you may record in heatmeUp is particularly sensitive (love and sex life, health). The Service is therefore built local-first: your journal stays on your phone, with no account, and is never sent to our servers.

1. Data controller

For processing carried out through the website, our exchanges with you and the technical services associated with heatmeUp, the data controller is:

  • DEUTSCH ELLIOT (HMU TECHNOLOGIES), sole trader under French law;
  • 47 rue de Cléry, 75002 Paris, France;
  • SIREN 923 906 481 – VAT number FR36923906481;
  • contact: hello@heatmeup.app.

The data recorded in the app stays on your device: we have no access to it and do not process it.

2. Data processed

2.1 In the app (local storage only)

Depending on how you use it, the app stores on your phone:

  • your journal: first names or nicknames, encounters, dates, chemistry, notes, places, parties, preferences and any contact details you choose to enter. This data is kept in the encrypted storage provided by the operating system;
  • photos you add to profiles, saved in the app’s local files;
  • your health tracking (if you turn the module on): PrEP doses, reminders for STI tests, treatments or DoxyPEP, tests, recorded STIs, risk windows and notified partners. This data is kept in the app’s local storage, on your phone;
  • your preferences: gender and attractions (to adapt wording and fields), tracking goals, language, custom fields and lists;
  • your security settings: lock settings (the passcode is stored hashed, never in plain text) and incognito settings. Face or fingerprint recognition is handled by the system: the app never receives biometric data;
  • the notifications you schedule, planned locally on the device.

The app includes no analytics, advertising or tracking tools.

When you search for a place in the app, the text you type (and, if you allow it, an approximate location to improve results) is sent to a mapping service through a technical function hosted by our infrastructure provider. The request is encrypted in transit; neither the search nor the location is stored or logged by us, and they are not linked to any identifier.

2.3 Notifying a partner

If you choose to tell a partner about an STI, the app directs you to the external website previensmoi.fr. The app does not send any data to that service: you send the message yourself from that website, whose privacy policy applies.

2.4 On the heatmeup.app website

  • Technical data: IP address, browser type, pages viewed, date and time, processed by our host to run and secure the website;
  • Audience measurement: aggregated, anonymised statistics (page views, country, device type), collected without cookies and without cross-site tracking;
  • Messages: your email address and message content if you write to us, plus any device information you choose to include;
  • Waitlist: if you sign up to hear about the app’s release, your email address, the platform you picked (iPhone or Android), the site language and the date you signed up.

2.5 In-app purchases

The Service currently offers no purchases. If in-app purchases were introduced, only strictly necessary information (transaction ID, offer type, status) would be processed, with payments handled by Apple or Google. This policy would then be updated.

Purpose Legal basis
Running the app and storing the journal locally Performance of the Terms; explicit consent for health and sex-life data (Art. 9(2)(a) GDPR), which stays on your device
Address search Performance of the Terms, at your request
Running and securing the website Legitimate interest in keeping the Service available and secure
Anonymised website audience measurement Legitimate interest in improving the website, without cookies
Replying to your messages Legitimate interest in answering your requests
Waitlist (a single email, when the app is released) Your consent (Art. 6(1)(a) GDPR), withdrawable at any time

4. Health and sex-life data

  • It is recorded and processed only on your device and is never sent to our servers.
  • You can export it to a CSV file for your own use (for example to show a healthcare professional). The exported file is then under your sole control.
  • You can delete it at any time from the app, or by uninstalling the app.

5. Security

We apply reasonable measures to protect your data: no account and no server storage of the journal, system encrypted storage for the journal, app sandboxing by the operating system, passcode and biometric lock, incognito mode and encrypted transmissions.

No system is infallible, so the security of your data also depends on your device: a strong unlock code, updates, device encryption enabled, and care with the backup files you export.

6. Retention

  • App data: kept on your device until you delete it or uninstall the app.
  • Address searches: not retained.
  • Website technical logs: kept for a limited period by our host, for security purposes.
  • Audience statistics: aggregated and anonymous.
  • Messages: kept while handling your request, then archived for up to 3 years after the last exchange.
  • Waitlist: kept until the launch announcement for that platform is sent, then deleted within 3 months — or immediately if you unsubscribe.

7. Recipients and processors

Within the scope of their tasks, the following may process data:

  • Vercel Inc. (United States): website hosting and cookieless audience measurement;
  • our infrastructure provider (Supabase): running the technical address search function, without retaining queries;
  • Apple and Google: app distribution and mapping services;
  • our email provider: receiving and sending our emails;
  • Brevo (France, European Union): running the waitlist and sending the launch announcement.

Where these providers are located outside the European Union, transfers are covered by appropriate safeguards (adequacy decisions, including the Data Privacy Framework, or the European Commission’s standard contractual clauses).

We never sell or rent any data.

8. Cookies

The heatmeup.app website sets no advertising or tracking cookies. Audience measurement works without cookies, and the language is determined by the page address, so no consent banner is needed. Should this change, your consent would be obtained beforehand where the law requires it.

9. Minors

The Service is not intended for people under 16. If we learn that someone under 16 has sent us data (by email, for example), we will delete it as soon as possible.

10. Your rights

For the data we process (website, messages), you have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to set instructions about what happens to your data after your death.

For app data, which is stored only on your device, you exercise these rights directly: view, edit, export and delete it from the app.

To exercise your rights: hello@heatmeup.app. If, after contacting us, you believe your rights have not been respected, you may lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the authority of your country of residence.

11. Changes

We may update this policy to reflect legal, technical or functional changes. If the changes are significant, we will let you know by appropriate means (website, app). The date of the last update is shown at the top of this page.

12. Contact

DEUTSCH ELLIOT (HMU TECHNOLOGIES) – 47 rue de Cléry, 75002 Paris, France – hello@heatmeup.app.